fc99b9483117e98d618fa709c9bff4944f52c445c452ee8fea3e92ca3e720e60

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/04/2026, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Invoice-PRMREGVK-0003.exe
Size 21.8MB
Sample260421-plc8msew2n
SHA256 fc99b9483117e98d618fa709c9bff4944f52c445c452ee8fea3e92ca3e720e60
MD5 d77bf25b85a45f68d7601a9b7d74c9d9
SHA1 8654d930b771f744c37d5afb2df51f4ae95801ed
SHA512 d0c763e0e0736ca6365f34e0c7eea606633ae2453e599a823c5165a7e68008a6dc04deb73ef5c847e03be42600be2dd8f418f57e3f33bf5a143e9cfd686bc514
SSDEEP 393216:+tolZoSUFNgCMOhVoBaAiUNaL70q1uzCJPeT8FJnehMOe5NI+Wb3Q:+tobo/qEVooAZNKYeJPeTe9B5JWc
TLSH
T159373338F6E55CBEDE3BAAFCD09E449B575AB5A603C4012327F1C6D28B213D4542EE09
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 5 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
384	netsh.exe
4004	netsh.exe
460	netsh.exe
4524	netsh.exe
1440	netsh.exe

Executes dropped EXE 26 IoCs

pid	Process
1868	unpack200.exe
1072	unpack200.exe
3364	unpack200.exe
1852	unpack200.exe
4808	unpack200.exe
3576	unpack200.exe
2404	unpack200.exe
4248	unpack200.exe
4996	windowslauncher.exe
4520	unpack200.exe
732	unpack200.exe
460	unpack200.exe
1976	unpack200.exe
3280	Remote AccessLauncher.exe
540	Remote Access.exe
4652	SimpleService.exe
4356	SimpleService.exe
2084	SimpleService.exe
3620	Remote Access Service.exe
416	Remote Access.exe
4696	session_win.exe
3368	elev_win.exe
1352	session_win.exe
1620	elev_win.exe
4524	session_win.exe
2316	elev_win.exe

Loads dropped DLL 55 IoCs

pid	Process
1868	unpack200.exe
1072	unpack200.exe
3364	unpack200.exe
1852	unpack200.exe
4808	unpack200.exe
3576	unpack200.exe
2404	unpack200.exe
4248	unpack200.exe
4520	unpack200.exe
732	unpack200.exe
460	unpack200.exe
1976	unpack200.exe
4528	Invoice-PRMREGVK-0003.exe
4528	Invoice-PRMREGVK-0003.exe
4528	Invoice-PRMREGVK-0003.exe
4528	Invoice-PRMREGVK-0003.exe
4528	Invoice-PRMREGVK-0003.exe
4528	Invoice-PRMREGVK-0003.exe
4528	Invoice-PRMREGVK-0003.exe
4528	Invoice-PRMREGVK-0003.exe
3280	Remote AccessLauncher.exe
3280	Remote AccessLauncher.exe
3280	Remote AccessLauncher.exe
3280	Remote AccessLauncher.exe
3280	Remote AccessLauncher.exe
3280	Remote AccessLauncher.exe
3280	Remote AccessLauncher.exe
540	Remote Access.exe
540	Remote Access.exe
540	Remote Access.exe
540	Remote Access.exe
540	Remote Access.exe
540	Remote Access.exe
540	Remote Access.exe
540	Remote Access.exe
540	Remote Access.exe
540	Remote Access.exe
416	Remote Access.exe
416	Remote Access.exe
416	Remote Access.exe
416	Remote Access.exe
416	Remote Access.exe
416	Remote Access.exe
416	Remote Access.exe
416	Remote Access.exe
416	Remote Access.exe
416	Remote Access.exe
416	Remote Access.exe
416	Remote Access.exe
416	Remote Access.exe
416	Remote Access.exe
416	Remote Access.exe
416	Remote Access.exe
416	Remote Access.exe
416	Remote Access.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3200614358\3235667997.pri	netsh.exe
File created	C:\Windows\rescache\_merged\92721896\4040467336.pri	netsh.exe
File created	C:\Windows\rescache\_merged\482193516\2918504333.pri	netsh.exe
File created	C:\Windows\rescache\_merged\431186354\1401774863.pri	netsh.exe
File created	C:\Windows\rescache\_merged\1045417640\1077058204.pri	netsh.exe
File created	C:\Windows\rescache\_merged\3479232320\3958949850.pri	netsh.exe
File created	C:\Windows\rescache\_merged\1712550052\874825209.pri	netsh.exe
File created	C:\Windows\rescache\_merged\3628602599\706060855.pri	netsh.exe
File created	C:\Windows\rescache\_merged\2530935351\3858858122.pri	netsh.exe
File created	C:\Windows\rescache\_merged\2263554406\1459521677.pri	netsh.exe
File created	C:\Windows\rescache\_merged\64831148\3281894443.pri	netsh.exe
File created	C:\Windows\rescache\_merged\2137598169\4233826534.pri	netsh.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 15 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	session_win.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	elev_win.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	session_win.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	session_win.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SimpleService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SimpleService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Remote Access Service.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.XboxGameCallableUI_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CShellExperienceHost_cw5n1h2txyewy%5Cresources.pri\1d7e5369a06a26c\a01460c8	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.CloudExperienceHost_cw5n1h2txyewy%5Cresources.pri\1d7e5366dd4697d\a01460c8\@{Microsoft.Windows.CloudExperienceHost_10.0.19041.1266_neutral_neutra = "Your account"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.LockApp_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.XboxGameCallableUI_cw5n1h2txyewy%5Cresources.pri\1d5acdddadc1b8f\a01460c8	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CParentalControls_cw5n1h2txyewy%5Cresources.pri\1d7e53665b78b3b\a01460c8	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Win32WebViewHost_cw5n1h2txyewy%5Cresources.pri\1d5acdef0fedca\a01460c8	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.ContentDeliveryManager_cw5n1h2txyewy%5Cresources.pri\1d5acddd82645c0\a01460c8	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.AppRep.ChxApp_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CParentalControls_cw5n1h2txyewy%5Cresources.pri\1d7e53665b78b3b\a01460c8\@{Microsoft.Windows.ParentalControls_1000.19041.1023.0_neutral_neutral_cw5n1h2txyewy?ms-res = "Microsoft family features"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.AppRep.ChxApp_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.AppRep.ChxApp_cw5n1h2txyewy%5Cresources.pri\1d5acddee1afafc\a01460c8\@{Microsoft.Windows.Apprep.ChxApp_1000.19041.1023.0_neutral_neutral_cw5n1h2t = "Windows Defender SmartScreen"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy%5Cresources.pri\1d5ace438733a83\a01460c8\@{Microsoft.Windows.SecureAssessmentBrowser_10.0.19041.1023_neutra = "Take a Test"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@peerdistsh.dll,-9002 = "BranchCache - Hosted Cache Server (Uses HTTPS)"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\icsvc.dll,-700 = "Virtual Machine Monitoring"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@wlansvc.dll,-36864 = "WLAN Service - WFD Application Services Platform Coordination Protocol (Uses UDP)"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.ContentDeliveryManager_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.PeopleExperienceHost_cw5n1h2txyewy%5Cresources.pri\1d7e53672e17460\a01460c8	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.LockApp_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5Cmicrosoft.windows.narratorquickstart_8wekyb3d8bbwe%5Cresources.pri\1d5acdded540f4d\a01460c8\@{Microsoft.Windows.NarratorQuickStart_10.0.19041.1023_neutral_neutral_ = "Narrator"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CParentalControls_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.PeopleExperienceHost_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.PeopleExperienceHost_cw5n1h2txyewy%5Cresources.pri\1d7e53672e17460\a01460c8\@{Microsoft.Windows.PeopleExperienceHost_10.0.19041.1023_neutral_neut = "Windows Shell Experience"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CShellExperienceHost_cw5n1h2txyewy%5Cresources.pri\1d7e5369a06a26c\a01460c8\@{Microsoft.Windows.ShellExperienceHost_10.0.19041.1023_neutral_neutral_cw5n1h2txyewy?ms = "Windows Shell Experience"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy%5Cresources.pri\1d5acddeb9898a7\a01460c8	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.CloudExperienceHost_cw5n1h2txyewy%5Cresources.pri\1d7e5366dd4697d\a01460c8	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.ContentDeliveryManager_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CParentalControls_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy%5Cresources.pri\1d5acddea4e2414\a01460c8	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5Cmicrosoft.windows.narratorquickstart_8wekyb3d8bbwe%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.AAD.BrokerPlugin_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.AccountsControl_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.LockApp_cw5n1h2txyewy%5Cresources.pri\1d7e5367a448984\a01460c8	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.Search_cw5n1h2txyewy%5Cresources.pri\1d7e5369da0bc36\a01460c8	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.AAD.BrokerPlugin_cw5n1h2txyewy%5Cresources.pri\1d5acdde7226641\a01460c8\@{Microsoft.AAD.BrokerPlugin_1000.19041.1023.0_neutral_neutral_cw5n1h2txyewy?ms-r = "Work or school account"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@peerdistsh.dll,-9003 = "BranchCache - Hosted Cache Client (Uses HTTPS)"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Win32WebViewHost_cw5n1h2txyewy%5Cresources.pri\1d5acdef0fedca\a01460c8\@{Microsoft.Win32WebViewHost_10.0.19041.1023_neutral_neutral_cw5n1h2txyewy?ms-reso = "Desktop App Web Viewer"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.XboxGameCallableUI_cw5n1h2txyewy%5Cresources.pri\1d5acdddadc1b8f\a01460c8\@{Microsoft.XboxGameCallableUI_1000.19041.1023.0_neutral_neutral_cw5n1h2txyewy? = "Xbox Game UI"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy%5Cresources.pri\1d5acddeb9898a7\a01460c8\@{Microsoft.Windows.OOBENetworkCaptivePortal_10.0.19041.1023_neut = "Captive Portal Flow"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.AAD.BrokerPlugin_cw5n1h2txyewy%5Cresources.pri\1d5acdde7226641\a01460c8	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5Cmicrosoft.windows.narratorquickstart_8wekyb3d8bbwe%5Cresources.pri	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy%5Cresources.pri\1d5acddea4e2414\a01460c8\@{Microsoft.Windows.StartMenuExperienceHost_10.0.19041.1023_neutra = "Start"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.PeopleExperienceHost_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.AppRep.ChxApp_cw5n1h2txyewy%5Cresources.pri\1d5acddee1afafc\a01460c8	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CShellExperienceHost_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@sstpsvc.dll,-35001 = "Secure Socket Tunneling Protocol"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@wifidisplay.dll,-100 = "Wireless Display"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\firewallapi.dll,-37302 = "mDNS"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy%5Cresources.pri\1d5ace438733a83\a01460c8	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.AccountsControl_cw5n1h2txyewy%5Cresources.pri\1d7e5366768b0fd\a01460c8\@{Microsoft.AccountsControl_10.0.19041.1023_neutral__cw5n1h2txyewy?ms-resource://M = "Email and accounts"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.LockApp_cw5n1h2txyewy%5Cresources.pri\1d7e5367a448984\a01460c8\@{Microsoft.LockApp_10.0.19041.1023_neutral__cw5n1h2txyewy?ms-resource://Microsoft.LockApp = "Windows Default Lock Screen"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.Search_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.XboxGameCallableUI_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Win32WebViewHost_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CShellExperienceHost_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.Search_cw5n1h2txyewy%5Cresources.pri\1d7e5369da0bc36\a01460c8\@{Microsoft.Windows.Search_1.14.2.19041_neutral_neutral_cw5n1h2txyewy?ms-resource:/ = "Windows Search"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy%5Cresources.pri	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@peerdistsh.dll,-9000 = "BranchCache - Content Retrieval (Uses HTTP)"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.AccountsControl_cw5n1h2txyewy%5Cresources.pri\1d7e5366768b0fd\a01460c8	netsh.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4696	session_win.exe
4696	session_win.exe
1352	session_win.exe
1352	session_win.exe
4524	session_win.exe
4524	session_win.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
416	Remote Access.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 4528 wrote to memory of 1868	4528	Invoice-PRMREGVK-0003.exe	86
PID 4528 wrote to memory of 1072	4528	Invoice-PRMREGVK-0003.exe	87
PID 4528 wrote to memory of 3364	4528	Invoice-PRMREGVK-0003.exe	88
PID 4528 wrote to memory of 1852	4528	Invoice-PRMREGVK-0003.exe	89
PID 4528 wrote to memory of 4808	4528	Invoice-PRMREGVK-0003.exe	90
PID 4528 wrote to memory of 3576	4528	Invoice-PRMREGVK-0003.exe	91
PID 4528 wrote to memory of 2404	4528	Invoice-PRMREGVK-0003.exe	92
PID 4528 wrote to memory of 4248	4528	Invoice-PRMREGVK-0003.exe	93
PID 4528 wrote to memory of 4996	4528	Invoice-PRMREGVK-0003.exe	94
PID 4528 wrote to memory of 4520	4528	Invoice-PRMREGVK-0003.exe	95
PID 4528 wrote to memory of 732	4528	Invoice-PRMREGVK-0003.exe	96
PID 4528 wrote to memory of 460	4528	Invoice-PRMREGVK-0003.exe	97
PID 4528 wrote to memory of 1976	4528	Invoice-PRMREGVK-0003.exe	98
PID 4528 wrote to memory of 3200	4528	Invoice-PRMREGVK-0003.exe	99
PID 4528 wrote to memory of 4644	4528	Invoice-PRMREGVK-0003.exe	101
PID 4528 wrote to memory of 4776	4528	Invoice-PRMREGVK-0003.exe	103
PID 4528 wrote to memory of 3496	4528	Invoice-PRMREGVK-0003.exe	104
PID 4528 wrote to memory of 988	4528	Invoice-PRMREGVK-0003.exe	107
PID 4528 wrote to memory of 2852	4528	Invoice-PRMREGVK-0003.exe	108
PID 4528 wrote to memory of 1240	4528	Invoice-PRMREGVK-0003.exe	110
PID 4528 wrote to memory of 3280	4528	Invoice-PRMREGVK-0003.exe	113
PID 3280 wrote to memory of 1904	3280	Remote AccessLauncher.exe	114
PID 4528 wrote to memory of 1072	4528	Invoice-PRMREGVK-0003.exe	116
PID 4528 wrote to memory of 204	4528	Invoice-PRMREGVK-0003.exe	118
PID 4528 wrote to memory of 4212	4528	Invoice-PRMREGVK-0003.exe	119
PID 4528 wrote to memory of 768	4528	Invoice-PRMREGVK-0003.exe	121
PID 4528 wrote to memory of 3464	4528	Invoice-PRMREGVK-0003.exe	122
PID 4528 wrote to memory of 540	4528	Invoice-PRMREGVK-0003.exe	126
PID 540 wrote to memory of 3120	540	Remote Access.exe	128
PID 540 wrote to memory of 4000	540	Remote Access.exe	130
PID 540 wrote to memory of 1588	540	Remote Access.exe	132
PID 540 wrote to memory of 2012	540	Remote Access.exe	134
PID 540 wrote to memory of 4336	540	Remote Access.exe	136
PID 540 wrote to memory of 5032	540	Remote Access.exe	137
PID 540 wrote to memory of 3540	540	Remote Access.exe	138
PID 540 wrote to memory of 4652	540	Remote Access.exe	142
PID 540 wrote to memory of 4356	540	Remote Access.exe	143
PID 2084 wrote to memory of 3620	2084	SimpleService.exe	145
PID 3620 wrote to memory of 416	3620	Remote Access Service.exe	146
PID 416 wrote to memory of 3052	416	Remote Access.exe	147
PID 416 wrote to memory of 4352	416	Remote Access.exe	149
PID 416 wrote to memory of 2252	416	Remote Access.exe	151
PID 416 wrote to memory of 2268	416	Remote Access.exe	152
PID 416 wrote to memory of 2172	416	Remote Access.exe	155
PID 416 wrote to memory of 2404	416	Remote Access.exe	157
PID 416 wrote to memory of 1440	416	Remote Access.exe	159
PID 416 wrote to memory of 1172	416	Remote Access.exe	161
PID 416 wrote to memory of 384	416	Remote Access.exe	164
PID 416 wrote to memory of 4004	416	Remote Access.exe	166
PID 416 wrote to memory of 460	416	Remote Access.exe	168
PID 416 wrote to memory of 4524	416	Remote Access.exe	170
PID 416 wrote to memory of 1968	416	Remote Access.exe	172
PID 416 wrote to memory of 3000	416	Remote Access.exe	174
PID 416 wrote to memory of 4696	416	Remote Access.exe	183
PID 4696 wrote to memory of 3368	4696	session_win.exe	184
PID 416 wrote to memory of 1352	416	Remote Access.exe	186
PID 1352 wrote to memory of 1620	1352	session_win.exe	187
PID 416 wrote to memory of 4524	416	Remote Access.exe	188
PID 4524 wrote to memory of 2316	4524	session_win.exe	189

C:\Users\Admin\AppData\Local\Temp\Invoice-PRMREGVK-0003.exe
"C:\Users\Admin\AppData\Local\Temp\Invoice-PRMREGVK-0003.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4528
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774523-4-app\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774523-4-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774523-4-app\lib\charsets.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774523-4-app\lib\charsets.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1868
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774523-4-app\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774523-4-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774523-4-app\lib\ext\access-bridge-64.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774523-4-app\lib\ext\access-bridge-64.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1072
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774523-4-app\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774523-4-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774523-4-app\lib\ext\cldrdata.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774523-4-app\lib\ext\cldrdata.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3364
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774523-4-app\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774523-4-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774523-4-app\lib\ext\jaccess.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774523-4-app\lib\ext\jaccess.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1852
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774523-4-app\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774523-4-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774523-4-app\lib\ext\sunmscapi.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774523-4-app\lib\ext\sunmscapi.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4808
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774523-4-app\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774523-4-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774523-4-app\lib\ext\sunpkcs11.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774523-4-app\lib\ext\sunpkcs11.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3576
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774523-4-app\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774523-4-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774523-4-app\lib\jsse.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774523-4-app\lib\jsse.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2404
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774523-4-app\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774523-4-app\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774523-4-app\lib\rt.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774523-4-app\lib\rt.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4248
- C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774523-4-app\bin\windowslauncher.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774523-4-app\bin\windowslauncher.exe" "-Xshare:dump"
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774522-3-app\customer.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774522-3-app\customer.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4520
- C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774522-3-app\pdfbox-2.0.19.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774522-3-app\pdfbox-2.0.19.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:732
- C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774522-3-app\fontbox-2.0.19.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774522-3-app\fontbox-2.0.19.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:460
- C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\unpack200.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\unpack200.exe" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774522-3-app\jwrapper_utils.jar.p2" "C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774522-3-app\jwrapper_utils.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1976
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWApps" /e /g "Users":F
  2⤵
  PID:3200
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\LastProxy" /e /g "Users":F
  2⤵
  PID:4644
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\DetectedProxies" /e /g "Users":F
  2⤵
  PID:4776
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\ProxyCredentials" /e /g "Users":F
  2⤵
  PID:3496
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\Remote_Access_ConfigureICO.ico" /e /g "Users":F
  2⤵
  PID:988
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\JWrapper-Remote Access-UninstallerICO.ico" /e /g "Users":F
  2⤵
  PID:2852
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\unrestricted" /e /g "Users":F
  2⤵
  PID:1240
- C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\Remote AccessLauncher.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\Remote AccessLauncher.exe" -cp "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\jwrapper_utils.jar;C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\customer.jar;C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\pdfbox-2.0.19.jar;C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\fontbox-2.0.19.jar" -Xmx256m -Xms5m -XX:MinHeapFreeRatio=15 -XX:MaxHeapFreeRatio=30 -XX:MaxGCPauseMillis=500 -Djava.util.Arrays.useLegacyMergeSort=true -Djava.net.preferIPv4Stack=true -Dapple.awt.UIElement=true -Xrs -Dsun.java2d.dpiaware=true -Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2 jwrapper.JWrapper "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\unrestricted\JWLaunchProperties-1776774531764-0"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3280
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\JRE-LastSuccessfulOptions-JWrapper-Windows64JRE-00063527423-complete" /e /g "Users":F
    3⤵
    PID:1904
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\ChosenLanguage" /e /g "Users":F
  2⤵
  PID:1072
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\unrestricted\jwLastRun" /e /g "Users":F
  2⤵
  PID:204
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00075795284-complete\unrestricted\jwLastRun" /e /g "Users":F
  2⤵
  PID:4212
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\unrestricted" /e /g "Users":F
  2⤵
  PID:768
- C:\Windows\SYSTEM32\cacls.exe
  cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\unrestricted\jwLastRun" /e /g "Users":F
  2⤵
  PID:3464
- C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\Remote Access.exe
  "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\Remote Access.exe" -cp "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\jwrapper_utils.jar;C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\customer.jar;C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\pdfbox-2.0.19.jar;C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\fontbox-2.0.19.jar" -Xmx256m -Xms5m -XX:MinHeapFreeRatio=15 -XX:MaxHeapFreeRatio=30 -XX:MaxGCPauseMillis=500 -Djava.util.Arrays.useLegacyMergeSort=true -Djava.net.preferIPv4Stack=true -Dapple.awt.UIElement=true -Xrs -Dsun.java2d.dpiaware=true -Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2 jwrapper.JWrapper "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\unrestricted\JWLaunchProperties-1776774532311-1"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:540
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\JRE-LastSuccessfulOptions-JWrapper-Windows64JRE-00063527423-complete" /e /g "Users":F
    3⤵
    PID:3120
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\serviceconfig.xml" /e /p "Users":R
    3⤵
    PID:4000
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\Remote Access Service.exe" /t /e /g "Users":F
    3⤵
    PID:1588
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\Remote Access Service.exe" /t /e /p "Users":R
    3⤵
    PID:2012
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\StopSimpleGatewayService.exe" /t /e /g "Users":F
    3⤵
    PID:4336
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\StopSimpleGatewayService.exe" /t /e /p "Users":R
    3⤵
    PID:5032
- - C:\Windows\SYSTEM32\cacls.exe
    cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted" /t /e /p "Users":R
    3⤵
    PID:3540
- - C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\SimpleService.exe
    "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\SimpleService.exe" -uninstall "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\simplegateway.service"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4652
- - C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\SimpleService.exe
    "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\SimpleService.exe" -install "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\simplegateway.service"
    3⤵
    - Executes dropped EXE
    PID:4356

C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\SimpleService.exe
"C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\restricted\SimpleService.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2084
- C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\Remote Access Service.exe
  "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\SimpleGatewayService\Remote Access Service.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3620
- - C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\Remote Access.exe
    "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\Remote Access.exe" "-Xmx256m" "-Xms5m" "-XX:MinHeapFreeRatio=15" "-XX:MaxHeapFreeRatio=30" "-XX:MaxGCPauseMillis=500" "-Djava.util.Arrays.useLegacyMergeSort=true" "-Djava.net.preferIPv4Stack=true" "-Dapple.awt.UIElement=true" "-Xrs" "-Dsun.java2d.dpiaware=true" "-Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2" "-cp" "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00075795284-complete\jwrapperlib\jwstandalonelaunch.jar" "jwrapper.updater.GenericUpdaterLaunch" "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00075795284-complete\unrestricted\JWLaunchProperties-2953040953-20"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:416
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\DetectedProxies" /e /g "Users":F
      4⤵
      PID:3052
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\ProxyCredentials" /e /g "Users":F
      4⤵
      PID:4352
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\unrestricted\jwLastRun" /e /g "Users":F
      4⤵
      PID:2252
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00075795284-complete\unrestricted\jwLastRun" /e /g "Users":F
      4⤵
      PID:2268
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\unrestricted\jwLastRun" /e /g "Users":F
      4⤵
      PID:2172
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWApps\JRE-LastSuccessfulOptions-JWrapper-Windows64JRE-00063527423-complete" /e /g "Users":F
      4⤵
      PID:2404
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh advfirewall firewall show rule name=all
      4⤵
      Modifies Windows Firewall
      Drops file in Windows directory
      Event Triggered Execution: Netsh Helper DLL
      Modifies data under HKEY_USERS
      PID:1440
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\serviceid.lock" /t /e /g "Users":f
      4⤵
      PID:1172
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh advfirewall firewall add rule "name=SH Remote Access Service" "description=Inbound rule for the Remote Access Service to facilitate access sessions" dir=in action=allow "program=C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\Remote Access.exe"
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:384
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh advfirewall firewall add rule "name=SH Remote Access Service Updater" "description=Inbound rule for the Remote Access Service updater" dir=in action=allow "program=C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\Remote AccessECompatibility.exe"
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4004
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh advfirewall firewall add rule "name=SH Remote Access Service Launcher" "description=Inbound rule for the launcher that can spawn the Remote Access Service" dir=in action=allow "program=C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\Remote AccessLauncher.exe"
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:460
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh advfirewall firewall show rule name=all
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      Modifies data under HKEY_USERS
      PID:4524
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\SimpleHelp" /t /e /g "Users":f
      4⤵
      PID:1968
  - - C:\Windows\SYSTEM32\cacls.exe
      cacls "C:\ProgramData\SimpleHelp\ElevateSH\*.*" /t /e /g "Users":f
      4⤵
      PID:3000
  - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\session_win.exe
      "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\session_win.exe" --slWaitForCompletion "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\elev_win.exe" --mouselocation
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4696
    - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\elev_win.exe
        
        "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\elev_win.exe" "--mouselocation"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3368
  - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\session_win.exe
      "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\session_win.exe" --slWaitForCompletion "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\elev_win.exe" --mouselocation
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1352
    - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\elev_win.exe
        
        "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\elev_win.exe" "--mouselocation"
        5⤵
        Executes dropped EXE
        
        PID:1620
  - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\session_win.exe
      "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\session_win.exe" --slWaitForCompletion "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\elev_win.exe" --mouselocation
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4524
    - - C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\elev_win.exe
        
        "C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\elev_win.exe" "--mouselocation"
        5⤵
        Executes dropped EXE
        
        PID:2316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DetectedProxies

Path C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\DetectedProxies
Size 4B
SHA256 df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119
MD5 f1d3ff8443297732862df21dc4e57262
SHA1 9069ca78e7450a285173431b3e52c5c25299e473
SHA512 ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3
MD5 SHA1 SHA512

Submit Download

secmsg-udpGVV18U139U243U159G9999.secmsg.afos_complete

Path C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\secmsg\secmsg-udpGVV18U139U243U159G9999.secmsg.afos_complete
Size 144B
SHA256 0caf20440e2477c2adeee5f6e2af5ae780847bbc680a1c00b45705c0201caf26
MD5 e9dfa71148e2f66ac0376ce78b3179dd
SHA1 9d1a881d2940c76435008833e2f02807a906dfd3
SHA512 ca96b761a85e3866874df23ed92301932102cf325a56e50f714813de3227a01cfe80424ad28010ff29d196b3d4d67fec621e3b7049143945934dd7770976ce0e
TLSH
T192C02B0F5741D944870B0248980044D11C8098116787FCACD98C1C770FC33F27A9F36F
MD5 SHA1 SHA512 TLSH

Submit Download

serviceconfig.xml

Path C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\serviceconfig.xml
Size 363B
SHA256 08b433805e324a81719b58b0add7cea909140c4514f4792b1fb22398301605fc
MD5 9a88182402d9c0e3f392335b11b87d50
SHA1 46fa893e221b08166d0aafa8b31fff98ddc28afa
SHA512 bf6319d5d72b5658865a0cc621101e98441d4b0a57f3345dd5711539b5e1ff7826fbd4bdba97e2f8a7f27d490fee807500cad8a5bd381637e8b5737e958bd970
TLSH
T179E02096F0A2F1BB92CD5347C831406C0B704A0857349889FDD94150FECE1743F1F8A0
MD5 SHA1 SHA512 TLSH

Submit Download

serviceconfig.xml

Path C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\serviceconfig.xml
Size 361B
SHA256 e84009e24f757d56ebde60c05697434d198b76300d95555eab73e8a2f181ef9b
MD5 d9f7259d685aa8f7d05a443ecfea867e
SHA1 bd855fb91c96271133149f423cf78d120f6a5af3
SHA512 df4789875316a2d5a5143d1917ecb8ff174f3da47e5800c5de6d2bf19e51495c9a13d52fde18099c21bd455ffc3929e20b0ccbc0517f315017c2d9598d3ccb14
TLSH
T1E1E0D896E0A2B17B92CD6347C821406C0B704A0857358849FDD54150FECA1747F1B8A1
MD5 SHA1 SHA512 TLSH

Submit Download

serviceconfig.xml

Path C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\serviceconfig.xml
Size 499B
SHA256 ac5927c53fe14c0b9bb9ed4c5671aec4eacfc0247474afd63d06edcfa03de80c
MD5 fd555c2c8b1624266c3c4a4eb917b545
SHA1 d423486fa978d34b65aad82a337fdf3329de3252
SHA512 c0081b9df4d6a0985eda1c0423b9411d3b0fa411a834d206c2b78c9d7b6ce3af3064799374135cb75bee3ae23e672600fc26abb0a7573862d1b5c822a87286ff
TLSH
T16CF09EA6F0A2B17A52CD534BC921406C0F70470D1730895DBEC55651EDCB1B13F1B9F0
MD5 SHA1 SHA512 TLSH

Submit Download

serviceid.dat.afos_complete

Path C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\serviceid.dat.afos_complete
Size 16KB
SHA256 285a497df7fceaa4b86401743d511d34620d7c3b53a3106c1ef19ed35ea37028
MD5 2deb28f00d4758f51c3abf09de98e6cb
SHA1 e84c6c29d298b0054e9f2a470428d67bacc687f2
SHA512 3767fc16fee3cfd3e44bc228e6e5b5c0fb0c008628b9ede93853722723c0c11a2d1c9e72fef99829104f6f5d948a0f9f6e500a024293e40a770a259974e62e05
SSDEEP 3:h5DFVgSq7gYoHFbO4lcYHBfSink8XFll:rFTLHBpPl
TLSH
T1E172121802D50675E08D317001D88C241ED6604842C4000CCDD004D210014B435BDE70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JreNameOverride.afos_complete

Path C:\ProgramData\JWrapper-Remote Access\JWApps\JreNameOverride.afos_complete
Size 13B
SHA256 e4c596fe101978f244b8f74be616d62bbaae083f881928da51255b0dba50d440
MD5 8199887131477d02232d372bc808cfd5
SHA1 c172ffd15c0fb02432429632272a066b8516e077
SHA512 8623a7e6bb4673572c47035280cecbf09d02a71de54f86a2a3376de080df33af8dbe0d2e5c460779a899ca3d51e5b4c7b1a264ed4089af40b05c187524606026
MD5 SHA1 SHA512

Submit Download

jwutils_win64.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00075795284-complete\jwutils_win64.dll
Size 184KB
SHA256 49c49b94e2a50b865f8a39eb8497bd97a9f3f4c585cd671f8c8fd2b05a24639a
MD5 e7a1e6e40b24adfea986efbcba166bcf
SHA1 f65b974bfaddf8df2e2f812cec31f0a793982ac7
SHA512 2d15c6e9cb3251d2823642319cc7e280c81b0a11cdd8bfea89f0506a3d8526c992e76ebd96cf6f8e33c5062f4f2e62dad3a900e3469938f5f7396caf94e6c1f9
SSDEEP 3072:aDPALDiICFHxb9Prh6Wm2Tv/dchUsZOqSc52ZK26yjdsBqpQ/YSPbR8za:4OGIy7Ru2sZO9cVcjGBJzPbRka
TLSH
T116045A96B29650F5D1BBD23CCAD24756FA7234144324A3CB16A48B792B73BE4B73D320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jwLastRun

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00075795284-complete\unrestricted\jwLastRun
Size 13B
SHA256 c4c5d9426022bcb5c4ad93fc1c661212948f47adb98add72770fa1042c236709
MD5 ec1c36286c818962c2e7cb9efd05feed
SHA1 9b3067a73439088f2dfde98b43b50370bc5a2f8c
SHA512 efa670a62daa1ea65c07a972ced2f247c37513cf4ed73f098a9516d15eea3a9019f791dd71236ee8be5a89b3e008bea14b4fefb6d0398ca2a7cd927bd6613746
MD5 SHA1 SHA512

Submit Download

jwLastRun

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-JWrapper-00075795284-complete\unrestricted\jwLastRun
Size 13B
SHA256 3b4a669b5b95db7dae9d30529aef387bbf0afbd5096b52b7358e835dcd89e1a9
MD5 298bae230c547a8c7322f9b7c3c3999b
SHA1 3680f8e9d709910fca344cad0a3ab8c0592a0b06
SHA512 08ae2fca0fe92b4e059c7254f5cf25d6957acc129956047f9b601062a14634a54774b364edf07fbd4fbf2811ca98dd7fa93957441078e614641f1b993dc101e6
MD5 SHA1 SHA512

Submit Download

jwBuildVersion

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access-00075795303-complete\jwBuildVersion
Size 11B
SHA256 6afd7786f03601285735b5053a5131887128fd9a214ecf1909290ccf49f01c07
MD5 daa3c36025e2f86bd0a8d8bf3be8353b
SHA1 e8a75213e06f643802ea1d7c821644b7327f442e
SHA512 4e9395c0895978b577ed58fcf05c5d0d2001f70930bda667e54971c6a1dc9c242f919a31831962dece5faf725437721466904fb668847208f7422f83245e281e
MD5 SHA1 SHA512

Submit Download

java.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\java.dll
Size 157KB
SHA256 5f77d3d190d3cb4ebb9b4f47aefe826bf6e15f383d6822e1a25a5729227ebf26
MD5 2b3f3da6a443e6be107e61628d220692
SHA1 c90416d47e8689e1338e71bb46946f7e67607fb3
SHA512 c6dcde0e83932506b5d18aa802e2747a4dd6fa9848a424a1d2db1a527b98b7676af67673d40e1a0e9b7f9bc9eecd88380273eb3d29169d681a4fd02324f6b6db
SSDEEP 3072:GwLr0BaOH91zgqMVasnXkI/M5WMsInVSVgcJj0mUgq:eTdGDVbUmYH97
TLSH
T1E9F3280B625640A7F89775B8B0166003E3B67468023D836F47E18B8E9FBF761BD97781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\net.dll
Size 95KB
SHA256 7181c21fa655d389d85c5cdb06c6b4359cde93e47c13269e09bfc5e87fb3cb39
MD5 dd7bf43cab35a227017af46a182c3b9f
SHA1 20cdb203f339d5ef8e80504276a9bf2051fe4342
SHA512 7f34126f121a3057b9d78120a5b8e82dc4a7f285662c0dc526fcc06a547176b66720179c4f41384f5073680d34f99d46020a23a77c2622abc0445ad08cd20d31
SSDEEP 1536:xxhrMqB0lDHzB047E3PkQKJxEFASBeU84qTRGSGkyepGi8Ljo+svghO:LhrSDF0v3PkQKXEFAhUqLrpTgls9
TLSH
T1D9932A08636860D5F877E1FCC2868607D7B3B0706620579F13A2C99B6FDBB617E19B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvm.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\server\jvm.dll
Size 8.4MB
SHA256 13b6c6c5c3d0f90588c6d16a2c00436dcf08044b0150a3cd71a15ee69472a6ff
MD5 be7b903d854715572c1c180344f913be
SHA1 7b2ebe4bfa6e3f2ee62e91cabd41636a56f9b77a
SHA512 af2d38a7ffc0f10e0b12cd108ae3a7054334cd4a84cd76095f00c4b28de431b94feec6e3c44e95c514f114855c209f42d58fb683f1eb246b2e2ec14538d6ce5a
SSDEEP 98304:9s4/l53KnlrNX3sEeylN951rtdsotEef3PpecH7ZL1Uk:9Z/l53Knlrt3sEeylP51rt+otEs3PzF
TLSH
T11F965A5762F000AAE9BEC278CE57E617D7F3785843319BCB66A017950B13FE52A7B210
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

verify.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\verify.dll
Size 48KB
SHA256 7e239d228728ffacdd098196b61e954d3af7da83b9359920934330be5866ba5f
MD5 68643834b2e8b5dd58d505c0c470bb56
SHA1 2bb2db6f7ad5029e7b978c52417ea4e3053b4c23
SHA512 7674228fb64d34ea563776c5d3a5e5a052da8a1089325e981421b8ea5e5eaaf96a38f837557885e859f4c79cb1d26e82e5620c3c98505654d49f09ee2158d2d3
SSDEEP 768:OYkpGTievAR+x/Olkj1ZyiQLdYn+KP1aU19pEiOTD6EB+w4vZij+ess3hDN:KELxRn3HfpEX63rvZZe/3hDN
TLSH
T173236B6362A86875E8C39074C697EFC7DAB1F8ED0354D18F14E4960EAF4BB512BD820D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zip.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapper-Windows64JRE-00063527423-complete\bin\zip.dll
Size 77KB
SHA256 49be17444b2612bde91d0f59aeaba2ef2deb14a12baa9b90a36d1ad87f9fef4b
MD5 bcc302e0d9f6bdb71cd5cf2f846a5e76
SHA1 b9c5f74430541d08f2a99d82633c7c81530f101a
SHA512 fed292db9cc2aa4c9a9528aac676a96ed48b30dc4ae9df4113670b8b1cec59b52a28f033bbce53787aa6d168c72e2826d2e7b9df670884b96629fa6def0b681b
SSDEEP 1536:ZRUGiGvAKb3shmHisnmjx++8o9IOQIO+VnToIfYt74s3h0Ou:ZRUcvTsc3JPo3G+9TBfYt747Ou
TLSH
T1A8738C994AE091A1FAF651B4C4E68B2FC772716052D4939F529C93922F433A23F483FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JWAuxiliaryArchive-Remote Access_macutils32

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774522-3-app\JWAuxiliaryArchive-Remote Access_macutils32
Size 1B
SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
MD5 93b885adfe0da089cdf634904fd59f71
SHA1 5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA512 b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee
MD5 SHA1 SHA512

Submit Download

customer.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774522-3-app\customer.jar
Size 16.4MB
SHA256 72c882d00a238df1b4b2f3a5026f780ab88129686ebbeb08ab718b15e690822a
MD5 12989e215d42d53a8d47206643a661dc
SHA1 01f53436ed70554811cec4b90f04c8234fc2ec0a
SHA512 06c265cc8ba38f747070cffd118c8d89ef953773bbd6cf3900a5b603b2c4a3ded3317d255bfe0ddc2eb19d81ff73836f36a5fa9631772db8573c0a979e0efe4d
SSDEEP 49152:fYvMdnX8N8ZBMhc9bz3RB/2CVWlgHS9if/vqmFt0Eu6OiGl3R1LrDtE2tVmxy/z4:fYdvhclPh5vKti2tVmxCBhhM2zsUE
TLSH
T1A0072A2BF3106E6FFB99D3BDB56183713AB068309283D161BFE958275ED61D88B442C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

customer.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774522-3-app\customer.jar.p2
Size 4.4MB
SHA256 b6bbeb3525ce23a79d001552f0bce93eb362f3ae6616bb589e189ab4a89caacc
MD5 49d4c8dd4112338163ae5413407e0e02
SHA1 8c135ca6998be32ca2cd02f2b2048024d0e14f2e
SHA512 f4e7a4e2553d20649fd8ade72df037f911b4c87fc2bab0b2f49c3358a5e212125018fc692b2708f2fb2c0445fcde50a475e28742b024d50a1b09bd0ab75c1b6d
SSDEEP 49152:b9ICuLxvMsl4HFEmrRORZOXWVFh43CUslIQxv0fMME5ueFcbP+cV3oaODZfSl7Vc:b9JrcEXgFib4IiXueFcbPqVfSl
TLSH
T1F3267C0BF70E629DE6911A3240B5A3496360D0493F322B937F1C5D68DD866C66E3BFC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fontbox-2.0.19.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774522-3-app\fontbox-2.0.19.jar
Size 1.5MB
SHA256 e879372ee9a043774a0248e9fa61976ade727803136350633830f3d757cdb6fc
MD5 da7e494a9eb3f2f49475700ba42d98d6
SHA1 0b7d2eeff13c04c50163b1c118510acd1345dd02
SHA512 04d0d9539caa74b63e0b12d4f64bef72469ad4f8a771598e95a02e79f0ed4cd3586ef43e27ca1d766d43c8504fdb3aff3a5ff5d482ec1f46e51259eaef611cca
SSDEEP 24576:0qcKx6QH6wGDuOYCzxqTq0G5Olv2VyFj8fbkEF/Ok4uWymXkVp0vyAXK6Gbxw:0qtfawGDuXCzx62OZhN8DJGDuPmIp0Yu
TLSH
T19975221AFF41D199F41B807A23978673BC7E868CF097969B097C12FA9460C154F8BBC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fontbox-2.0.19.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774522-3-app\fontbox-2.0.19.jar.p2
Size 3.5MB
SHA256 a112312f601965a60c7de425685a9b3ee1445dbb043c3cd88c2ca133c2be7c15
MD5 7f2bb19d616360f7bc5e2a2e4fdbec9c
SHA1 e4e3419e519e04d96b27db2e2cbb3a72948eba59
SHA512 4478c82e609ae243c09363cb83f6f8925c21f5a12ab3e4285728b458e01315c59191b90f218e8cff5de420c5f495b261be05fa9ffd94d293de8db72c26f0a373
SSDEEP 98304:graBPvylKGpcM0vB36FgOqWfW40K0kdTCtVZY/dElZufDSXSXjvYP5BMJkl1K4GP:uknylKGp6vR6FgOzfWNKPCtVZ62lZ2WY
TLSH
T1730687F748586C40C687D16B91300DE3C22FE538664BC36973A8FA73EF8B165799BA50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jwrapper_utils.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774522-3-app\jwrapper_utils.jar
Size 3.3MB
SHA256 d789a9f939f7a926fa3b08137da7466c829706a95af17d659e64fe735c410140
MD5 5fdcea0e66dade69779669d028ea4e5e
SHA1 62fe5847bb42e387f116d838c2c5872b25275505
SHA512 1c671edb102fd24504a2c92138534b42e8f35eb44b309e00dab2c6060b10b8fb29f12b176758f1220dc5553c3628d76865408a2c0e2944dd3af09976b4921c58
SSDEEP 24576:jMZiPqKIUaIZv+3S94r9vCFqZqxujw/M+dncQhMeiSujg00WfMgK:QIP0ZI1qZqxujw/lqGt7QMgK
TLSH
T150F55C17F1105E1BF281E77D19A08368777060708613F7B26FA8A82B9EE62E4EF453D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jwrapper_utils.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774522-3-app\jwrapper_utils.jar.p2
Size 1.1MB
SHA256 9a93a0625a78f36940d2df13a6da68126e93e663b4139a8f7de0f43809e1c0eb
MD5 4d63ad9c4e49c81199d0f271f503085e
SHA1 09e3ed532ce106933273be8370e880ab7caf47f2
SHA512 921d8d98b77dcaaf293a8ba3d7608abb5c80f9a0d59e621984b90d7d0d65fae588a7aca638b5764b1c2921ed32a22bda3175604bd417cebf9d1469c45883141f
SSDEEP 24576:eOQNb1Q3WM58lVVw5Ai8zBwk6eUeq10JQ:nQNb1QGMOi5S1J6zeyAQ
TLSH
T17F354A07F64D7BA9D1910B3508E1878A5376C0086B3227D33F1C6964DEC37EB5D2AEA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdfbox-2.0.19.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774522-3-app\pdfbox-2.0.19.jar
Size 2.6MB
SHA256 de62ce4a1513649b3b571f35f93c8b74b8ef65ea098423fa434b726c3abb4ea0
MD5 5d716baee12737ab8d96a8c41b2178fd
SHA1 ff3fdf5d0b3072bef45281e2696100ccf80c6baf
SHA512 06eabdcd14076c3938ce518a947dac27dd8cf0109fd7516248aea822da97c7d0b8ea4a7710aca3c029836cc05e6ff5c92118aaf313d3168715f0b6b2c9f5e764
SSDEEP 49152:DQwQdQveK9jNyo7G+AWZvs3q+0drCGCdIhxJr:kQvb9MMu6XRWIXp
TLSH
T12CC502A5B999C831FC1F513459E2C4727C3585CAC986708ED69C039F9EEA8681F03B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdfbox-2.0.19.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774522-3-app\pdfbox-2.0.19.jar.p2
Size 2.9MB
SHA256 7ae50f66e2e47552721b9a04d4ec76fad05ceb7c033987ccde1407f82768e338
MD5 8d2c514d341bed4db12aa51cdae10744
SHA1 962bba27490a77a473b4811f49d1bddc67887817
SHA512 56496f4d6ae34eee2884060b9e146418a9309efe7790a782712147a468c9fef858064b6df60b3726e6992ff99c3da3e17549897a5ce1f0023f1056df4f3ea7ff
SSDEEP 24576:h5rsdELbNSD/Mu8LEsaw7VGo8T0QS/+1hrxK6nZTMgjm0RzBA5voV3:7rsgiMusEsaw58S/4HK6nagjmW+oV3
TLSH
T1D1E53998728AD505C503483680E3D79351D9F60B9AE3360FB8FC7BCBCAD6B11D25A91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCR100.dll

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774523-4-app\bin\MSVCR100.dll
Size 808KB
SHA256 b4bfa27f677295b00a1df9a7e14db4b75cac2dd41b898d4e9a378eccce3699f0
MD5 aed6d63cfa5a3ef7021af9c457fee994
SHA1 f6ad746ef520b03df6cf0f5a2512d0df964c4688
SHA512 5573b17eb19d13cc96df5d66ef60cc8ff98e1ac9d8582a870ed2befa28ee271fb41741a92aa703234150fceadf4a436d10b8a6518c1816d0c804eb1261650d2d
SSDEEP 24576:C5e4L1vwTowTWqwVeeK7R/myyKgn9IrzOI:C5e4LfUWqAacn9Y
TLSH
T1EC059D9536A907F6D177D53DC996D206F2B2741513315BEB01A08AAE2F23FE09A3F312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unpack200.exe

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774523-4-app\bin\unpack200.exe
Size 195KB
SHA256 63f6352610d455ad5978e0d37f42a9d2f75bc092b4431d1f3cc0d5931d08152d
MD5 7e1051e9f1ed7a745c8f898e5e613cc6
SHA1 59cc4c4e86e57fc985f2f6d21a8cbc27370027db
SHA512 936e26cdd75ee13c3e9bc43b471a83126ce1737907b33cdd855d6a1818d686baa6c52dc55a208cda896cc753ff3e56447a3cef7382b64e5b13771c54ce30e37f
SSDEEP 3072:xAFlu97I7b6Cw94t0yoqIyqdYoNPyM/TBfxAqQNTwd+6Y7m9yd:xH97W6C64tthIks6GTBZAqQNTwd+nd
TLSH
T190147CA22BA011A2D9F68179D9C3C72BDBB63565037493CB50D883A21F036D46BB53FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowslauncher.exe

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774523-4-app\bin\windowslauncher.exe
Size 350KB
SHA256 c4c3a7458bd6e320a09e880954aeab965191954c028fbc5accadec4c5f4c01f6
MD5 4ce82fc3554d7325cfcb73d60bd9862c
SHA1 ef9e23450ce2b9615ddf203f4ed49c7abdeacce9
SHA512 2aaad32f7626a8b25896238879fc1980a4b6fe3731c7c7c401df8be7a6323df29e754821a5a37b0d28b5187924459e75dd32770d98a6d7bed3030598223efb54
SSDEEP 3072:Fxi+TpxEKLUwkjJvnWsv9rJuQgnTiAkLRccllDm9tZeYGlf:mESjMsVVuQgiPluWlf
TLSH
T1DC7437B672F230F5C7B6B23989920642A761B425032273CB167085354AF77EB6E397F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

charsets.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774523-4-app\lib\charsets.jar
Size 2.9MB
SHA256 293da0fddf18e7ae4e1a30ce5703716a0005e9ff5dae3784d4ec7a80df8ae798
MD5 3a7e352203320cac070079f17bfc7880
SHA1 804bb8386d681024cc813aefaaaaabfd67fe126b
SHA512 48f416034addcbe4d6a6647e7eb083272c98c364808505eb527be2e88e5d1de3aa5f8daec7b83bb6211a51b18f9c29eecb719954abb33b1b1eb83c49d3d7e131
SSDEEP 49152:OJriCuz1nXhO7dAVZd1LRIAEpT4nvvnVlbI8ew:gridzNmiN6qn3VlbI4
TLSH
T131E5AFD344491E6FD20B52BF1B60EE0B770E78AA0907B240F9B95C19E95D72F68D2F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

charsets.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774523-4-app\lib\charsets.jar.p2
Size 1022KB
SHA256 02f4bec339cf53d57a78912791fde50daef053954f7b5b933ff3050ad732ca19
MD5 a40d0e4736d9016b531cdc24d57f5905
SHA1 d3ee48936e12dbcbc206b18e0fe9acf219dde6dd
SHA512 4aa87a70a6f7bf5a56b5bba3885def6f4c620aa412b1abeafe8b129040d56ef53f4b3641788850e33c2bff430d9ce030815371e866a809a55ae8763449625039
SSDEEP 12288:h+BXim0XyhTMeRoqkobZ36qoRFsQn3cE1JrEU3s4F:hiym0eRog56Pn3HvF
TLSH
T1F42583037D6C3A64D61E6F714AB98F56933350183B970AEBDA186A18CEF31F35611BE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

access-bridge-64.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774523-4-app\lib\ext\access-bridge-64.jar
Size 191KB
SHA256 4fc33f9a5e88bf83bf6d9484cef092c0ee81576728ecebc1445af78e065f2f3d
MD5 71a8be3a6f8deb227ef6afb1e8e28cc7
SHA1 308cd9127ac4ab2e4affc9a030afde5472f51e16
SHA512 bbb35fc2ca545a81f91b265a74cf784fb0664e5d105e6744e65eaeb64df35f64511df15a108f47924867212cbd1fbc185eaba3f72615e0f91300f359b282e345
SSDEEP 3072:kXJV63Upvho5UoBJR6PPm+q0He0KIzhLALYlT7q9JvllY:QJX8ain6Xm+g0KUdSCT7q9Jc
TLSH
T1CD145B03FE598467F90782B350A1EE527B486D7CD0A6937F4DD91A883652C0A0736FBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

access-bridge-64.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774523-4-app\lib\ext\access-bridge-64.jar.p2
Size 67KB
SHA256 d8f89da65ce9b468422ac63572f5223feaab23fd31994062aea32ff51d72e32f
MD5 a52839b91db27e6904148affbf00c910
SHA1 eea0e11bb22933a3c3821ac502db59523401baea
SHA512 96df8aead702bec74f5a2bd63b792aca4ab61e1ae8c41f0e390d752d52ced3bab9779514dd424d36ae7d47ae73d92b157ddc3861345bb0c3d8d79b0b253dcb83
SSDEEP 1536:ZUsyQQIr6KznR0M/IEzKO9als9SgqBo6OjjYIKKuSWdddddKfaW3ttapIII3gA3Q:Hm4InulFNw
TLSH
T13763A456BF8B3112E69BA7721DF07640172CC354672F27B67F68962AC4D22D3422FC4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cldrdata.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774523-4-app\lib\ext\cldrdata.jar
Size 3.7MB
SHA256 19694ff19a6f89cf5fed5353457898e287ff2ea19bf314dd781fa812a665b0e5
MD5 8cb5ddb698558b042fc2711c69bd76da
SHA1 a4ec75a2b38c80508753e2e0d61785fdd64e3d4f
SHA512 9ef553cf38216cead747bceae4a62885418290e5ed529ae0aed1707794f7629ca14e7fde32592ddf565ed2a539d5aa64e16fc3d40a377bf7f371ca4613c4a3e5
SSDEEP 98304:TKiFxbGv91qcqsFydXLCAPI5+0/whCbjB0pHna5j98bkpp:1FxbGS5N/0/jSp65Jz
TLSH
T1960602D2BDB94432C27398F60420C513B509C19DF056949BDAF84A8A2AF5FD6E343EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cldrdata.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774523-4-app\lib\ext\cldrdata.jar.p2
Size 3.9MB
SHA256 dd4745f9b2e9bb0be9dd7456f0409e7cbb2ebf32799c5c582d5f1d151eca9fe2
MD5 94d9c1d8b6039010549463091e3f0da1
SHA1 d9bebd56141e61567d32ca1c044d2a88f8e8febf
SHA512 b9b0cbd0353c8f1f9eae682cbdfc8116289b35f7b7108d977779b81b91f2373f758e89694ded895d6d6901de585f8627916d07f13a74292002f67ae79b27fee3
SSDEEP 49152:zwSOi8bdfSAY3YQMhHBUmrMSHQnKH1WsE:+fbd6AY+Bzr3HeR
TLSH
T15D161E9365CBBA4BA3D01F285B724268153FE65801A77F18F161B3FCEB72163EE91424
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jaccess.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774523-4-app\lib\ext\jaccess.jar
Size 42KB
SHA256 f974270dae89a778068545aeac1d08e4f365491f71e51786aad201360aa5bb19
MD5 3d3d4fbe856f6f24eb4a05043629100b
SHA1 83db2742d1b33527287dbe3abb86804f73ab3f31
SHA512 782ea6c705d2095b259eaa81c3e0ac1e0d13a58d4ed1d30fe31a8b5df92a1800d452bf37a64e75e2a31691a4a9df7605fcf3748d41614a53e4142228f41ee7ac
SSDEEP 768:B+hKlewenw5eLrCj5mcLAr/vJ9zCBxAIjlJsH1jmQmSM:NQweenLAjJ9WBxA4VxV
TLSH
T19613BF576F14903BE712F2F3C226EB45B604AAB4C17640AE1D980D8937A1C4B4766EFF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jaccess.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774523-4-app\lib\ext\jaccess.jar.p2
Size 35KB
SHA256 14cfd2b22dec236d5f4414b0516dd237539e3740d284413adf4a68273d776dee
MD5 e86163108a0a136ee2247c8c3eedf038
SHA1 699c17815adc3f5599b0367365615a9013677728
SHA512 f8aa141ea4a806aade3f37740304ee753e1aa876bf756773a1293af774f7c7f40c9eca03aa95d82a66890442d586fb54572b774150f915a0d1d76723e4ee07e7
SSDEEP 384:3+eNocIxRNMNo8CDYhYUZ1d3Vh6yDZvi7dmXypppppppppppppppppYppppppppR:pN3IxRGND1hZ1d3Oamdm9hKa5
TLSH
T163F272062747F226C3D8FE3EABFD4249427096C8B71F28966F905058EE978C7290DD8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunmscapi.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774523-4-app\lib\ext\sunmscapi.jar
Size 31KB
SHA256 741ecd111ccfda89abe6950185720b8c6e0cbd9c48a4aa813eaace9eedb98739
MD5 8cfda80f6092a348434153bf8c861078
SHA1 d6fb67e571917cb3247c70bfacef54143c958b91
SHA512 b611215b0c43c4bb1ba143e0088353635bf669d920f1fd6d627c600501f336202d8f67fceebc7ab1347fd5f96885f42caa6ec70f2021c53ff20edce2524e130c
SSDEEP 768:C+LghJaxLlqgX8bQ/MbUtIkgHSzgTn2Bkxh/qIDCBLhUdyzdN77lNb1Zrn1pF+63:z0hJaRo1bQ/eUtIkgHSzgaBih/qU+Lhr
TLSH
T1D7E2AF97FD9EC0E8F007CAF78114B14A275C05788D92632A87E58A0EFE11D2717167EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunmscapi.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774523-4-app\lib\ext\sunmscapi.jar.p2
Size 23KB
SHA256 2144c97f87a59a82b456ad5dbf643a919ac2ecbf3bad65b6951885e00868f049
MD5 172c7486ec0fe80c8b79cb46c67b775f
SHA1 21282fb0d88e7c3ffef59150b47eee662804f252
SHA512 d04fd010875289efcd03421e3c0b6addd650b785f693bdff02e4394897c5e9a7769217ef506a352c754f02e23ec56b8c43ab7814cb9d113f2b1428a075809d28
SSDEEP 384:vvI22iHBnpHW6wjF8xdvx1ZH6R1OVgX6gljVaHaHmHMcH4HDHQH7HgrHKHzHgHIl:vvI22iHBnpMjF8jnZHOOaKgljIHaHmHJ
TLSH
T176B22A53F61E40E0F1C515FA60FA2146573CAAD2EE130B3A5E88426CF981BB787751F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunpkcs11.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774523-4-app\lib\ext\sunpkcs11.jar
Size 238KB
SHA256 931ef9cd86cb8dad75b5c5b897a28cc50ab2c8594aa688e2a3f7fdc5e792e141
MD5 f0e38530f8daf9a35318042ffc734bf8
SHA1 0cb05e2bbe37ef9eba163bbeec512132adb56cc4
SHA512 cb5649aa16da09a7a9cf4243cbc1877efd636239dbb6cdff444453a85dc144bc009424b27c5389453c3f9f37b4caf80f400d9c68f84d86e60ad28a3fa11f4753
SSDEEP 6144:qVtYGKQoqtk8x7fe3Z62eBGvgrLQexkSXtBRCxRFhB:P8f28x7fuZ6LBmgrTCSDUxhB
TLSH
T19934F186BCAC987DE52361BFCD209246A61C0A2EC207E17F0565850DB17987A07F7FF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunpkcs11.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774523-4-app\lib\ext\sunpkcs11.jar.p2
Size 165KB
SHA256 faae5c01233308fc9b1dc81fc21d1f00abd3f9e64000272220ff51524495e43d
MD5 f63fe532d16529ff2a9c29895811f722
SHA1 fd0355837f4f35fff61ac8e868ba4cd5af8cb548
SHA512 c2447dd74396560476412d3c904dafac725adae832937ce8e82af753f2e1973230fb007fc8835d13db96d2d873351bd995fcfc9085e7181d9f7f85401222e225
SSDEEP 1536:/t1+/OCxJoKJHVFfuWtnewck+ECkpleybjWehUXykhvFokdAtjd8Eli0OGJgZfTp:/vGVvFfj49HSeybaSUXykxFlCtjdZ5qz
TLSH
T16AF35C03B20E34A1D9D227BB9DA44259123CE48D8F770B5A6DCC45ACF6461B38A73FE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsse.jar

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774523-4-app\lib\jsse.jar
Size 657KB
SHA256 f0e62b5e2e7cce1142d2d92796e4f72ebeef5b48619d38b3119a07215fa65157
MD5 d755e0c6cb12459514483b46ed2f8450
SHA1 9a11c48ea3ed6c6aae204189bf1ae3a7008f02da
SHA512 edbaf4833acbeee0ca8c8b9e1e76c7478097cf0bb611885e64659ef5837b61e87250c3cf21566271e7b9098ee9db9b3023d2eb445890a24eea8f75cada9b8700
SSDEEP 6144:866t8vo2BJJHgi0HnPD9L9xH2xJaWYwWHmllrvNvYJAlvO6H+dWefJ4+F:EYAnV20woyDvThg
TLSH
T1B7E4C517E20D55BFF284EAFF9871432C23346C325963E3794E49492AF9C65F14AB0AE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsse.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774523-4-app\lib\jsse.jar.p2
Size 187KB
SHA256 34ea8e6503dca372934b0f919d605c166f9a2927b2f9e7a4ec1bc1cbaaff1aec
MD5 7063c170a35de18153b4a3cc051896fe
SHA1 704454a9b40a71ff2e7095c274208a19853088a4
SHA512 8993409a67ab94438e520cba43481882cb20b59a668a4adf90ff618816186a3c418badc0d6d3decc0b61bdfb81d44d360c97d3bfc52c85397920c11653a61367
SSDEEP 3072:Y/p7a7115iTgupo2Ap5queewfAaFGCCCCbIP/6wEkOottm1:Y/Za71jiTguO2Axeew4CPrLPm1
TLSH
T1E3147C077F0A2446E3E53A73A0F57AAA9338D108363707676F4A15A8CD875E38B1EDD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rt.jar.p2

Path C:\ProgramData\JWrapper-Remote Access\JWrapperTemp-1776774523-4-app\lib\rt.jar.p2
Size 15.6MB
SHA256 6017f2034ca6a1b30d995181f0ea836eb51eebe9bdaddfd27d95f5122978c3ed
MD5 7237793709def0be4fbdf87c8d5e669b
SHA1 23c443e48fee5f1d2387689439b154eca1e012e3
SHA512 65b3402416658ab310f439d1bca8a66fe222f7b6dfee7e7d721e98e237c1111154c85b1498a54ee1c8845352fd1f2c1ed38b5c2d35a0827dc9b3819e6505b891
SSDEEP 196608:KLUfAMux5WAA4DAVQ83sgMT2RUv+piP8jE7AU:CX5WAA4DAVQ83sgMT22RPqU
TLSH
T1A2F66D07B54F758AE2901F3140B2265E123AE2082B372B577E1C67B8DD43297BE17F99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Remote AccessWinLauncher.exe

Path C:\ProgramData\JWrapper-Remote Access\Remote AccessWinLauncher.exe
Size 538KB
SHA256 6da0691e19faa283d291bbe99af654fec4f7db3f05f68e308bc33637b2091a41
MD5 133bbd5f859abad6d15b77fd188aca40
SHA1 151eea6d83e2bfafdeb4226d229f5bb86f29d372
SHA512 6d2cd3aeacae1262bfcc6c2e9fa5da7adf5a15281d5f78338e46c51e3288459ec3c33d0c5b3cc722ec139b4ce13abed9bd4c161d937abf1232fd56221dec44d5
SSDEEP 6144:3PWh3m0k3YfHbPr+t/LRMGxrICk+zwYOLdcHGJTgUA:fR0BqpRMGur8wt5Tgb
TLSH
T1C3C4D924B6E19DB9DF276AFCE04E88EB5A5FC9E303C5002327F186E5CA602D5841ED5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SimpleService.exe

Path C:\ProgramData\SimpleHelp\ElevateSH\SimpleService.exe
Size 94KB
SHA256 d3be3d6b69dd3ea3bc20d06eafc452b8810d7e58286bdbf21d194d0966f75f40
MD5 aa8bac20c523a9cd4ac3424655498d24
SHA1 e8ed0b823bc2484a80cb6d79423a204953dd0d55
SHA512 0d4dee182116e935e407eb3bef590490e718d54ccc9c12d6a94b823cbfdfec6101778f91ba7e229b7ffe9a828a90c1d13351058cf650ee189942df1e92aa85ae
SSDEEP 1536:CLbP7be/V/xaTIn5ei4dJe5xmtvgX93uSpp2ca9hXQetjiPWmV:RHj93uukbXQetjmh
TLSH
T11B93AE52B4D0C0B2C45641730985CB769B3EF8366F3A489377F81B9A9E622C55B3F28D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/384-778-0x000002A91D120000-0x000002A91D24A000-memory.dmp

Download

memory/416-707-0x0000000000440000-0x0000000000441000-memory.dmp

Download

memory/416-676-0x0000000000440000-0x0000000000441000-memory.dmp

Download

memory/416-860-0x0000000000440000-0x0000000000441000-memory.dmp

Download

memory/416-841-0x0000000000440000-0x0000000000441000-memory.dmp

Download

memory/416-839-0x0000000000440000-0x0000000000441000-memory.dmp

Download

memory/416-826-0x0000000000440000-0x0000000000441000-memory.dmp

Download

memory/416-822-0x0000000000440000-0x0000000000441000-memory.dmp

Download

memory/416-820-0x0000000000440000-0x0000000000441000-memory.dmp

Download

memory/416-815-0x00000000130A0000-0x00000000131CA000-memory.dmp

Download

memory/416-795-0x0000000000440000-0x0000000000441000-memory.dmp

Download

memory/416-792-0x0000000000440000-0x0000000000441000-memory.dmp

Download

memory/416-788-0x0000000000440000-0x0000000000441000-memory.dmp

Download

memory/416-787-0x0000000000440000-0x0000000000441000-memory.dmp

Download

memory/416-774-0x0000000000440000-0x0000000000441000-memory.dmp

Download

memory/416-764-0x0000000000440000-0x0000000000441000-memory.dmp

Download

memory/416-606-0x0000000000440000-0x0000000000441000-memory.dmp

Download

memory/416-612-0x0000000013060000-0x0000000013092000-memory.dmp

Download

memory/416-621-0x0000000000440000-0x0000000000441000-memory.dmp

Download

memory/416-640-0x0000000000440000-0x0000000000441000-memory.dmp

Download

memory/416-753-0x0000000000440000-0x0000000000441000-memory.dmp

Download

memory/416-631-0x0000000000440000-0x0000000000441000-memory.dmp

Download

memory/416-646-0x0000000000440000-0x0000000000441000-memory.dmp

Download

memory/416-650-0x0000000013210000-0x0000000013242000-memory.dmp

Download

memory/416-652-0x0000000000440000-0x0000000000441000-memory.dmp

Download

memory/416-656-0x0000000000440000-0x0000000000441000-memory.dmp

Download

memory/416-664-0x0000000000440000-0x0000000000441000-memory.dmp

Download

memory/416-671-0x00000000136E0000-0x00000000136FA000-memory.dmp

Download

memory/416-672-0x0000000013980000-0x00000000139B2000-memory.dmp

Download

memory/416-677-0x0000000000440000-0x0000000000441000-memory.dmp

Download

memory/416-716-0x0000000000440000-0x0000000000441000-memory.dmp

Download

memory/416-688-0x0000000000440000-0x0000000000441000-memory.dmp

Download

memory/416-698-0x0000000000440000-0x0000000000441000-memory.dmp

Download

memory/460-784-0x000002C08FE60000-0x000002C08FF8A000-memory.dmp

Download

memory/540-594-0x0000000014540000-0x000000001466A000-memory.dmp

Download

memory/540-589-0x0000000000500000-0x0000000000501000-memory.dmp

Download

memory/540-533-0x0000000000500000-0x0000000000501000-memory.dmp

Download

memory/540-581-0x0000000000500000-0x0000000000501000-memory.dmp

Download

memory/540-537-0x0000000000500000-0x0000000000501000-memory.dmp

Download

memory/540-540-0x0000000014500000-0x0000000014532000-memory.dmp

Download

memory/540-555-0x0000000000500000-0x0000000000501000-memory.dmp

Download

memory/540-567-0x0000000000500000-0x0000000000501000-memory.dmp

Download

memory/540-593-0x0000000000500000-0x0000000000501000-memory.dmp

Download

memory/1440-773-0x0000018530A30000-0x0000018530B5A000-memory.dmp

Download

memory/3280-473-0x00000000143B0000-0x00000000143E2000-memory.dmp

Download

memory/3280-468-0x0000000002280000-0x0000000002281000-memory.dmp

Download

memory/3280-480-0x0000000002280000-0x0000000002281000-memory.dmp

Download

memory/3280-481-0x0000000014400000-0x000000001452A000-memory.dmp

Download

memory/4004-781-0x0000011EEADE0000-0x0000011EEAF0A000-memory.dmp

Download

memory/4524-793-0x0000016990930000-0x0000016990A5A000-memory.dmp

Download

memory/4528-385-0x00000000023C0000-0x00000000023F2000-memory.dmp

Download

memory/4528-390-0x00000000022B0000-0x00000000022B1000-memory.dmp

Download

memory/4528-377-0x00000000022B0000-0x00000000022B1000-memory.dmp

Download

memory/4528-536-0x0000000004890000-0x0000000004B00000-memory.dmp

Download

memory/4528-356-0x0000000004890000-0x0000000004B00000-memory.dmp

Download

memory/4528-404-0x00000000022B0000-0x00000000022B1000-memory.dmp

Download

memory/4528-535-0x000000001F0D0000-0x000000001F1FA000-memory.dmp

Download

memory/4528-506-0x00000000022B0000-0x00000000022B1000-memory.dmp

Download

memory/4528-527-0x00000000022B0000-0x00000000022B1000-memory.dmp

Download